Overview

History

The Blackberry was first introduced in 1999 by a company called Research in Motion (RIM).

Operating System

Models

7100 Series

7700 Series

7520

7700 Series

8700 Series

Forensics

RIM's push technology adds a new and different look at the forensics investigation of a PDA. Unlike traditional PDA's that need to be synchronized with a host computer with the use of a cradle or docking station, Blackberry's are synchronized wirelessly by the pushing of data onto the device. This means that the data on the device could potentially be changing at any moment. Also, a blackberry is never really off. What seems like “off” to the user is really only the display, keyboard, and radio being disabled. So when the device is powered back on to the user, items that have been waiting to be pushed to the device from the server begin immediately. This does not give the forensics examiner the time needed to shut down the device. For this reason, the first step in the acquisition of a Blackberry is to leave it off. The device should only be turned back on when it is in a place that cannot receive a signal and thus nothing can be pushed to it.

StrongHold Bag

In order to prevent the device from connecting to the network, the Blackberry can be placed inside of a Faraday Bag, which blocks radio transmissions. Paraben Corporation, one of the developers of cell phone forensics equipment, produces such a Faraday Bag dubbed the Wireless StrongHold Bag. First responders can help to maintain the integrity of evidence contained in wireless devices through the use of this equipment. It should be noted that power should be supplied to the device if the data is volatile in nature, but the cable may introduce a pathway for electromagnetic signals to penetrate the controlled environment.

Paraben's Wireless StrongHold Bag is weaved from three layers of nickel, copper, and nylon silver. The company also produces a StrongHold Tent, which allows the investigator to enter the radio signal dampened environment and also to bring in other equipment, such as laptops, in order to facilitate the investigation.